CVE-2018-17783: MantisBT allows XSS via Edit Filter page
A cross-site scripting (XSS) vulnerability in the Edit Filter page (managefilteredit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
Other sources
MantisBT allows XSS via Edit Filter page
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.17.2
Event History
Frequently Asked Questions
What is CVE-2018-17783?
CVE-2018-17783 is a cross-site scripting (XSS) vulnerability in MantisBT.
How does the vulnerability CVE-2018-17783 affect MantisBT?
The vulnerability allows remote attackers to inject arbitrary code through a crafted project name.
What is the severity of CVE-2018-17783?
The severity of the vulnerability is medium with a CVSS score of 5.4.
What is the Common Weakness Enumeration (CWE) ID for CVE-2018-17783?
The CWE ID for CVE-2018-17783 is CWE-79.
How can I fix the cross-site scripting vulnerability in MantisBT (CVE-2018-17783)?
To fix the vulnerability, update MantisBT to version 2.17.1 or above.